Demo
· synthetic data environment — all IPs and findings are fictitious
Product
Book a call
ThreatDB
Dashboard
External IPs
Internal IPs
Queries
Whitelist
Runs
Trigger Pipeline
Edit Query: 03-LowVolume_HighFreq
Name (unique)
IP column name
Enabled
ESQL
FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*), avg_src_bytes = AVG(source.bytes) BY src = source.ip, dst = destination.ip, port = destination.port | WHERE conn_count >= 80 AND avg_src_bytes >= 50 AND avg_src_bytes <= 3000 | SORT conn_count DESC
Save Changes
Cancel